From 5d20547c380ed2ada9c8f03ab860c78f3b636b3b Mon Sep 17 00:00:00 2001
From: Cody Bruno <cody@turbot.com>
Date: Tue, 5 Dec 2023 15:11:46 -0500
Subject: [PATCH] Update all echo to transform steps

---
 lookup_iocs/lookup_file_hash.fp                       | 4 ++--
 report_inactive_okta_accounts/deactivate_okta_user.fp | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lookup_iocs/lookup_file_hash.fp b/lookup_iocs/lookup_file_hash.fp
index 609c5db..5ac90de 100644
--- a/lookup_iocs/lookup_file_hash.fp
+++ b/lookup_iocs/lookup_file_hash.fp
@@ -56,7 +56,7 @@ pipeline "lookup_file_hash" {
     request_body = "hash=${param.file_hash}"
   }
 
-  step "echo" "lookup_file_hash" {
+  step "transform" "lookup_file_hash" {
     json = {
       virustotal_file_scan : step.pipeline.virustotal.output.file_analysis.data,
       urlscan_file_scan : step.pipeline.urlscan.output.scan_result,
@@ -71,4 +71,4 @@ pipeline "lookup_file_hash" {
       hybrid_analysis_file_hash_lookup : step.http.hybrid_analysis_file_hash_lookup.response_body
     }
   }
-}
\ No newline at end of file
+}
diff --git a/report_inactive_okta_accounts/deactivate_okta_user.fp b/report_inactive_okta_accounts/deactivate_okta_user.fp
index 49deb92..4e277a4 100644
--- a/report_inactive_okta_accounts/deactivate_okta_user.fp
+++ b/report_inactive_okta_accounts/deactivate_okta_user.fp
@@ -89,7 +89,7 @@ pipeline "deactivate_okta_accounts" {
     }
   }
 
-  step "echo" "condition_info" {
+  step "transform" "condition_info" {
     for_each = { for user in step.pipeline.list_users.output.users : user.id => user }
     text     = "${timecmp(each.value.lastLogin, timeadd(timestamp(), "-${param.inactive_hours}h"))} user ${each.value.profile.email} lastlogin ${each.value.lastLogin} status ${each.value.status}"
   }